CVE-2026-41268 is a critical unauthenticated remote command execution flaw (CVSS 9.8) in Flowise. Versions up to 3.0.13 let one HTTP request bypass a parameter override check and run commands inside the Flowise container. Upgrade to 3.1.0, and treat exposed instances as suspect.
What's affected
The GitHub advisory lists the npm packages flowise and flowise-components at 3.0.13 and earlier. Version 3.1.0 is the patched release. The advisory says commands run with root privileges inside the containerized Flowise instance, and that no authentication or prior knowledge of the instance is needed.
How to check if you're exposed
npm ls flowise flowise-components
For Docker, read the image tag in use, and compare it with 3.1.0. Any internet reachable Flowise on an older version should be treated as exposed. If your instance sits behind a login proxy or a private network, the practical risk is lower, but fix it on the same schedule.
Check container logs and running processes for unexpected activity. Also find out which containers run as root and which hold cloud credentials or API keys in their environment, since those define the damage.
What to do now
- Upgrade Flowise to 3.1.0 or later and redeploy the container.
- Take any unpatched instance off the public internet until it is upgraded.
- Rotate API keys, database passwords and cloud credentials stored in or reachable from instances that were exposed.
- Run the container as a non-root user with a read-only file system where possible.
- Review logs for unexpected requests to the prediction endpoints.
Why it matters
The record lists CWE-20, improper input validation. The advisory describes two connected mistakes. First, a check meant to skip a file input used a substring match instead of a prefix match, so a marker string anywhere in a value passed it, and that skipped the check for which parameters may be overridden. Second, the Custom MCP node blocked a list of dangerous environment variables but did not include one that Node.js reads at startup to load code.
Both are small gaps with large reach. A blocklist invites this kind of miss, because defenders must name every dangerous value while attackers need one. Allowlists, strict type checks and least privilege in the container shrink the whole class. The record does not flag this CVE as known exploited.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Do I need credentials to hit this?
The advisory says no authentication is required. Network reachability to the instance is the condition.
Is the container isolation enough?
It limits blast radius but does not remove the risk. Root inside the container, plus mounted secrets, can still be serious. Upgrade and rotate secrets.
Sources
Last reviewed: 19 October 2026.
